1561
Important security vulnerabilities in OpenVPN
UPDATE: OpenVPN fuzzers now released. Summary I’ve discovered 4 important security vulnerabilities in OpenVPN. Interestingly, these were not found by the two recently completed audits of Open…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1562
How are cyber criminals rolling in 2025?
Speaking of earning a living, would you expect them to pay for web hosting/ cloud providers?
1563
Demystifying CORS
CORS (Cross-Origin Resource Sharing) is subject tinged with dread for many web developers. Like tales of a mythical sea beast, every developer has a story to tell about the day CORS seized upon one of their web requests, dragging it down into the inexorable depths, never to be seen again.
1564
How many users block Google analytics? (2017)
Comparing Google Analytics with server logs
1565
1566
The coming industrialisation of exploit generation with LLMs
Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…
1567
No strcpy either
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
1568
Intercepting Zoom's encrypted data with BPF
How to use Rust and BPF to intercept the data sent and received by programs that use OpenSSL.
1569
Spectre and the end of langsec
wingolog: article: spectre and the end of langsec
1570
1571
OnStar Begins Spying On Customers’ GPS Location For Profit
I canceled the OnStar subscription on my new GMC vehicle today after receiving an email from the company about their new terms and conditions. While most people, I imagine, would hit the delete button when receiving something as exciting as new terms and conditions, being the nerd sort, I decided to have a personal…
1572
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.
1573
1574
Tachy0n: The Last 0day Jailbreak
Siguza’s Blog
1575
Mysteries of Telegram Data Centers (2022)
Telegram claims to have 5 data centers (DCs), referred to as DC1~5 in Telegram’s code and documentation. Among them, DC1 and DC3 are located in Miami, USA; DC2 and DC4 are in Amsterdam, Netherlands; and DC5 is in Singapore. Each account is associated with a DC upon registration and does not change with the…
1576
Docker Image Insecurity
Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.
1577
1578
1579
Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
Upon first launch, Sunrise invites you to create an account, then asks you to add a calendar. The first option, “iCloud Calendar”, brings you to a screen where the Sunrise app itself, in its native interface and code, solicits your Apple ID (iCloud) email address and password.
1580
EU "Chat Control" and Mandatory Client Side Scanning
On the 11th of October, Dutch parliament organized a hearing on the EU “Chatcontrol” proposal, with a focus on client side scanning. Dutch parliament had earlier passed two motions calling on the Dutch government not to support this proposal, but our government has declared it will ignore those motions. This hearing…
1581
Why Privacy Matters
MABAR69 merupakan situs judi online yang menawarkan permainan terlengkap seperti slot online, poker online, bola online, tembak ikan, sabung ayam dan casino online.
1582
Hijacking Email with Cloudflare Email Routing
On Tuesday, December 7th 2021 I discovered a critical vulnerability in Cloudflare’s Email Routing service. This vulnerabilty enabled anyone to modify the routing configuration of any domain using the service. A bad actor could have overwritten the destination address to their own email address in order to read any…
1583
TeleMessage, used by Trump officials, can access plaintext chat logs
💡Update May 18, 2025: I described TeleMessage's trivial vulnerability in an article for WIRED: How the knock-off Signal app used by Trump officials got hacked in 20 minutes Update May 19, 2025: Uh oh: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server Update
1584
1585
On the Juniper backdoor
You might have heard that a few days ago, Juniper Systems announced the discovery of “unauthorized code” in the ScreenOS software that underlies the NetScreen line of devices. As a resu…
1586
Don't Take Security Advice from SEO Experts or Psychics
As best I understand it, one of the most effective SEO things you can do is to repeat all the important words on your site down the bottom of the page. To save it from looking weird, you make the text the same colour as the background so people can'
1587
Understanding the ginormous Philippines data breach
Remember when OPM got breached last year [https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach]? There was a lot of excitement in various parts of the world (namely the US) because here we had a government department (Office of Personnel Management), and they’d just lost 21.
1588
1589
Escaping surveillance capitalism, at scale
Self-hosting and paid subscriptions promise an escape from surveillance capitalism. What guarantees do they really offer, and at what cost?
1590